Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2022 23:02
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
225KB
-
MD5
f842773eeae971948df273f1b72811ef
-
SHA1
53c32961609be41cbbaf6a7c239c28ceb7edbcad
-
SHA256
2dac1cdea62e957d9e4652f5b2fbed2b9643ac4bd7bd63a1ca03e82d3a070cf2
-
SHA512
600be0ea76790cc071f8be7901168acc1ae34e8251647576e141a6586a17ff132aa00b7de577e1bfc9e48d73fa6db25b28dbf9c3eb0be4a9e82b899c1ec98daf
-
SSDEEP
3072:12YUzLDzeTo5uYvWkrc/ftfEufmSWwelixMlc6NZHCxKRXPH8oS+Ei+Y3Ox6qQo3:4LDiTlk6ftnfm1l1eKB8oJN+Hk5o
Malware Config
Extracted
redline
mario23_10
167.235.252.160:10642
-
auth_value
eca57cfb5172f71dc45986763bb98942
Extracted
djvu
http://ex3mall.com/lancer/get.php
-
extension
.isza
-
offline_id
m3KmScxfDyEQzJYP8qjOSfP4FvpsOXlekGuMPzt1
-
payload_url
http://uaery.top/dl/build2.exe
http://ex3mall.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-oWam3yYrSr Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@fishmail.top Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0622JOsie
Extracted
amadey
3.61
62.204.41.79/U7vfDb3kg/index.php
Extracted
amadey
3.63
62.204.41.182/g9TTnd3bS/index.php
Extracted
amadey
3.60
193.42.33.28/game0ver/index.php
Extracted
redline
Installs3
89.23.96.2:7253
-
auth_value
fd80b5722a90ed6c0cf5ba897d0e4c4b
Extracted
socelars
https://hdbywe.s3.us-west-2.amazonaws.com/wduwe19/
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detected Djvu ransomware 10 IoCs
Processes:
resource yara_rule behavioral2/memory/5100-167-0x0000000002230000-0x000000000234B000-memory.dmp family_djvu behavioral2/memory/1964-168-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1964-171-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1964-172-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1964-174-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1964-190-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3264-210-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3264-208-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3264-219-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3264-304-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Detects Smokeloader packer 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2728-133-0x00000000005A0000-0x00000000005A9000-memory.dmp family_smokeloader behavioral2/memory/4116-181-0x00000000004D0000-0x00000000004D9000-memory.dmp family_smokeloader C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe family_smokeloader C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe family_smokeloader behavioral2/memory/2884-220-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4900 4216 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/688-143-0x0000000000400000-0x0000000000460000-memory.dmp family_redline behavioral2/memory/452-151-0x0000000000440000-0x00000000004AA000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000009001\mp3studios_97.exe family_socelars C:\Users\Admin\AppData\Local\Temp\1000009001\mp3studios_97.exe family_socelars -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
bd.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bd.exe -
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exerundll32.exerundll32.exeflow pid process 184 4184 rundll32.exe 198 5496 rundll32.exe 201 5248 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 40 IoCs
Processes:
D6CD.exeD806.exeDA78.exeDDA6.exeE018.exeE25B.exeD806.exegntuud.exeD806.exeLegs.exenbveek.exeD806.exebuild.exebin.exeWinComService.exeLivability.exesystem32.exetrud.exebuild2.exelinda5.exebuild2.exebuild3.exebd.exez1ugk979.execsgd2.exesuper9.exemp3studios_97.exegntuud.exerandom.exerandom.exepb1109.exenbveek.exeWinComService.exemstsca.exeLiva100.exesuper9.exe94C4.exegntuud.exenbveek.exeWinComService.exepid process 452 D6CD.exe 5100 D806.exe 4252 DA78.exe 4116 DDA6.exe 4084 E018.exe 4904 E25B.exe 1964 D806.exe 4480 gntuud.exe 4696 D806.exe 4288 Legs.exe 432 nbveek.exe 3264 D806.exe 2884 build.exe 4972 bin.exe 3344 WinComService.exe 4740 Livability.exe 3520 system32.exe 4232 trud.exe 1784 build2.exe 2356 linda5.exe 4328 build2.exe 1208 build3.exe 4564 bd.exe 4288 z1ugk979.exe 2096 csgd2.exe 2240 super9.exe 3744 mp3studios_97.exe 1604 gntuud.exe 1456 random.exe 3336 random.exe 2344 pb1109.exe 540 nbveek.exe 4620 WinComService.exe 4964 mstsca.exe 2360 Liva100.exe 2328 super9.exe 3032 94C4.exe 3420 gntuud.exe 1548 nbveek.exe 4616 WinComService.exe -
Processes:
resource yara_rule behavioral2/memory/2344-366-0x0000000140000000-0x0000000140617000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
bd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bd.exe -
Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WinComService.exelinda5.exebuild2.exeDA78.exeD806.exenbveek.exeD806.exerandom.execsgd2.exegntuud.exeLegs.exebin.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation WinComService.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation linda5.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation build2.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation DA78.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation D806.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation nbveek.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation D806.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation random.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation csgd2.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation gntuud.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation Legs.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation bin.exe -
Loads dropped DLL 10 IoCs
Processes:
rundll32.exerundll32.exebuild2.exerundll32.execsgd2.exerundll32.exerundll32.exerundll32.exepid process 2176 rundll32.exe 5008 rundll32.exe 4328 build2.exe 4328 build2.exe 5040 rundll32.exe 2096 csgd2.exe 2096 csgd2.exe 4184 rundll32.exe 5496 rundll32.exe 5248 rundll32.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts rundll32.exe -
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
Processes:
rundll32.exerundll32.exerundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
nbveek.exeWinComService.exesuper9.exeD806.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\linda5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005051\\linda5.exe" nbveek.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000034050\\system32.exe" WinComService.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bd.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000038050\\bd.exe" WinComService.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\super9 = "C:\\Users\\Admin\\AppData\\Roaming\\super9.exe" super9.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\e7292bf6-0390-4308-a547-2325f5d851ca\\D806.exe\" --AutoStart" D806.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\trud.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000004051\\trud.exe" nbveek.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
bd.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 api.2ip.ua 23 api.2ip.ua 40 api.2ip.ua -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
bd.exedescription ioc process File opened for modification \??\PhysicalDrive0 bd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
bd.exepid process 4564 bd.exe 4564 bd.exe 4564 bd.exe 4564 bd.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
D6CD.exeD806.exeD806.exebuild2.exez1ugk979.exerundll32.exedescription pid process target process PID 452 set thread context of 688 452 D6CD.exe AppLaunch.exe PID 5100 set thread context of 1964 5100 D806.exe D806.exe PID 4696 set thread context of 3264 4696 D806.exe D806.exe PID 1784 set thread context of 4328 1784 build2.exe build2.exe PID 4288 set thread context of 1116 4288 z1ugk979.exe vbc.exe PID 4184 set thread context of 4048 4184 rundll32.exe rundll32.exe -
Drops file in Program Files directory 10 IoCs
Processes:
mp3studios_97.exedescription ioc process File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js mp3studios_97.exe File opened for modification C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js mp3studios_97.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html mp3studios_97.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js mp3studios_97.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js mp3studios_97.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js mp3studios_97.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json mp3studios_97.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png mp3studios_97.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js mp3studios_97.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js mp3studios_97.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 12 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3124 452 WerFault.exe D6CD.exe 2076 4252 WerFault.exe DA78.exe 4420 4084 WerFault.exe E018.exe 4892 4904 WerFault.exe E25B.exe 4832 3520 WerFault.exe system32.exe 4696 4288 WerFault.exe z1ugk979.exe 3156 4232 WerFault.exe trud.exe 2496 5040 WerFault.exe rundll32.exe 5744 2096 WerFault.exe csgd2.exe 5920 1604 WerFault.exe gntuud.exe 5256 3032 WerFault.exe 94C4.exe 6036 3420 WerFault.exe gntuud.exe -
Checks SCSI registry key(s) 3 TTPs 11 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
DDA6.exebd.exefile.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DDA6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DDA6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DDA6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 bd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID bd.exe -
Checks processor information in registry 2 TTPs 30 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
csgd2.exerundll32.exebuild2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 csgd2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString csgd2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4564 schtasks.exe 4308 schtasks.exe 3164 schtasks.exe 3640 schtasks.exe 4548 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 4220 timeout.exe 5768 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4028 taskkill.exe -
Processes:
description ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 -
Modifies registry class 30 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000098557700100054656d7000003a0009000400efbe6b55586c985577002e00000000000000000000000000000000000000000000000000bc8dd500540065006d007000000014000000 Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 101 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
pid process 1704 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 2728 file.exe 2728 file.exe 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 1704 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1704 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
file.exeDDA6.exepid process 2728 file.exe 4116 DDA6.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AppLaunch.exeLivability.exetrud.exevbc.exesuper9.exemp3studios_97.exedescription pid process Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeDebugPrivilege 688 AppLaunch.exe Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeDebugPrivilege 4740 Livability.exe Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeDebugPrivilege 4232 trud.exe Token: SeShutdownPrivilege 1704 Token: SeCreatePagefilePrivilege 1704 Token: SeDebugPrivilege 1116 vbc.exe Token: SeDebugPrivilege 2240 super9.exe Token: SeCreateTokenPrivilege 3744 mp3studios_97.exe Token: SeAssignPrimaryTokenPrivilege 3744 mp3studios_97.exe Token: SeLockMemoryPrivilege 3744 mp3studios_97.exe Token: SeIncreaseQuotaPrivilege 3744 mp3studios_97.exe Token: SeMachineAccountPrivilege 3744 mp3studios_97.exe Token: SeTcbPrivilege 3744 mp3studios_97.exe Token: SeSecurityPrivilege 3744 mp3studios_97.exe Token: SeTakeOwnershipPrivilege 3744 mp3studios_97.exe Token: SeLoadDriverPrivilege 3744 mp3studios_97.exe Token: SeSystemProfilePrivilege 3744 mp3studios_97.exe Token: SeSystemtimePrivilege 3744 mp3studios_97.exe Token: SeProfSingleProcessPrivilege 3744 mp3studios_97.exe Token: SeIncBasePriorityPrivilege 3744 mp3studios_97.exe Token: SeCreatePagefilePrivilege 3744 mp3studios_97.exe Token: SeCreatePermanentPrivilege 3744 mp3studios_97.exe Token: SeBackupPrivilege 3744 mp3studios_97.exe Token: SeRestorePrivilege 3744 mp3studios_97.exe Token: SeShutdownPrivilege 3744 mp3studios_97.exe Token: SeDebugPrivilege 3744 mp3studios_97.exe Token: SeAuditPrivilege 3744 mp3studios_97.exe Token: SeSystemEnvironmentPrivilege 3744 mp3studios_97.exe Token: SeChangeNotifyPrivilege 3744 mp3studios_97.exe Token: SeRemoteShutdownPrivilege 3744 mp3studios_97.exe Token: SeUndockPrivilege 3744 mp3studios_97.exe Token: SeSyncAgentPrivilege 3744 mp3studios_97.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
Processes:
chrome.exerundll32.exerundll32.exepid process 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 1704 1704 1704 1704 1704 1704 1704 1704 1704 4048 rundll32.exe 4184 rundll32.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe 3840 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
pid process 1704 1704 1704 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 1704 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
D6CD.exeD806.exeDA78.exeD806.exegntuud.exeLegs.exenbveek.exeD806.exedescription pid process target process PID 1704 wrote to memory of 452 1704 D6CD.exe PID 1704 wrote to memory of 452 1704 D6CD.exe PID 1704 wrote to memory of 452 1704 D6CD.exe PID 1704 wrote to memory of 5100 1704 D806.exe PID 1704 wrote to memory of 5100 1704 D806.exe PID 1704 wrote to memory of 5100 1704 D806.exe PID 452 wrote to memory of 688 452 D6CD.exe AppLaunch.exe PID 452 wrote to memory of 688 452 D6CD.exe AppLaunch.exe PID 452 wrote to memory of 688 452 D6CD.exe AppLaunch.exe PID 452 wrote to memory of 688 452 D6CD.exe AppLaunch.exe PID 452 wrote to memory of 688 452 D6CD.exe AppLaunch.exe PID 1704 wrote to memory of 4252 1704 DA78.exe PID 1704 wrote to memory of 4252 1704 DA78.exe PID 1704 wrote to memory of 4252 1704 DA78.exe PID 1704 wrote to memory of 4116 1704 DDA6.exe PID 1704 wrote to memory of 4116 1704 DDA6.exe PID 1704 wrote to memory of 4116 1704 DDA6.exe PID 1704 wrote to memory of 4084 1704 E018.exe PID 1704 wrote to memory of 4084 1704 E018.exe PID 1704 wrote to memory of 4084 1704 E018.exe PID 1704 wrote to memory of 4904 1704 E25B.exe PID 1704 wrote to memory of 4904 1704 E25B.exe PID 1704 wrote to memory of 4904 1704 E25B.exe PID 5100 wrote to memory of 1964 5100 D806.exe D806.exe PID 5100 wrote to memory of 1964 5100 D806.exe D806.exe PID 5100 wrote to memory of 1964 5100 D806.exe D806.exe PID 5100 wrote to memory of 1964 5100 D806.exe D806.exe PID 5100 wrote to memory of 1964 5100 D806.exe D806.exe PID 5100 wrote to memory of 1964 5100 D806.exe D806.exe PID 5100 wrote to memory of 1964 5100 D806.exe D806.exe PID 5100 wrote to memory of 1964 5100 D806.exe D806.exe PID 5100 wrote to memory of 1964 5100 D806.exe D806.exe PID 5100 wrote to memory of 1964 5100 D806.exe D806.exe PID 4252 wrote to memory of 4480 4252 DA78.exe gntuud.exe PID 4252 wrote to memory of 4480 4252 DA78.exe gntuud.exe PID 4252 wrote to memory of 4480 4252 DA78.exe gntuud.exe PID 1964 wrote to memory of 4476 1964 D806.exe icacls.exe PID 1964 wrote to memory of 4476 1964 D806.exe icacls.exe PID 1964 wrote to memory of 4476 1964 D806.exe icacls.exe PID 1964 wrote to memory of 4696 1964 D806.exe D806.exe PID 1964 wrote to memory of 4696 1964 D806.exe D806.exe PID 1964 wrote to memory of 4696 1964 D806.exe D806.exe PID 4480 wrote to memory of 4564 4480 gntuud.exe schtasks.exe PID 4480 wrote to memory of 4564 4480 gntuud.exe schtasks.exe PID 4480 wrote to memory of 4564 4480 gntuud.exe schtasks.exe PID 4480 wrote to memory of 4288 4480 gntuud.exe Legs.exe PID 4480 wrote to memory of 4288 4480 gntuud.exe Legs.exe PID 4480 wrote to memory of 4288 4480 gntuud.exe Legs.exe PID 4288 wrote to memory of 432 4288 Legs.exe nbveek.exe PID 4288 wrote to memory of 432 4288 Legs.exe nbveek.exe PID 4288 wrote to memory of 432 4288 Legs.exe nbveek.exe PID 432 wrote to memory of 4308 432 nbveek.exe schtasks.exe PID 432 wrote to memory of 4308 432 nbveek.exe schtasks.exe PID 432 wrote to memory of 4308 432 nbveek.exe schtasks.exe PID 4696 wrote to memory of 3264 4696 D806.exe D806.exe PID 4696 wrote to memory of 3264 4696 D806.exe D806.exe PID 4696 wrote to memory of 3264 4696 D806.exe D806.exe PID 4696 wrote to memory of 3264 4696 D806.exe D806.exe PID 4696 wrote to memory of 3264 4696 D806.exe D806.exe PID 4696 wrote to memory of 3264 4696 D806.exe D806.exe PID 4696 wrote to memory of 3264 4696 D806.exe D806.exe PID 4696 wrote to memory of 3264 4696 D806.exe D806.exe PID 4696 wrote to memory of 3264 4696 D806.exe D806.exe PID 4696 wrote to memory of 3264 4696 D806.exe D806.exe -
outlook_office_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D6CD.exeC:\Users\Admin\AppData\Local\Temp\D6CD.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 2682⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\D806.exeC:\Users\Admin\AppData\Local\Temp\D806.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\D806.exeC:\Users\Admin\AppData\Local\Temp\D806.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\e7292bf6-0390-4308-a547-2325f5d851ca" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\D806.exe"C:\Users\Admin\AppData\Local\Temp\D806.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\D806.exe"C:\Users\Admin\AppData\Local\Temp\D806.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exe"C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exe"C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exe" & exit7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build3.exe"C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build3.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 452 -ip 4521⤵
-
C:\Users\Admin\AppData\Local\Temp\DA78.exeC:\Users\Admin\AppData\Local\Temp\DA78.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000050001\Legs.exe"C:\Users\Admin\AppData\Local\Temp\1000050001\Legs.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe"C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000002001\bin.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\bin.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe"C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN WinComService.exe /TR "C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe" /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "WinComService.exe" /P "Admin:N"&&CACLS "WinComService.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a4e2bd6d47" /P "Admin:N"&&CACLS "..\a4e2bd6d47" /P "Admin:R" /E&&Exit7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "WinComService.exe" /P "Admin:N"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "WinComService.exe" /P "Admin:R" /E8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\a4e2bd6d47" /P "Admin:N"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\a4e2bd6d47" /P "Admin:R" /E8⤵
-
C:\Users\Admin\AppData\Roaming\1000034050\system32.exe"C:\Users\Admin\AppData\Roaming\1000034050\system32.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 4728⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\1000038050\bd.exe"C:\Users\Admin\AppData\Roaming\1000038050\bd.exe"7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\1000040001\super9.exe"C:\Users\Admin\AppData\Local\Temp\1000040001\super9.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000003001\Livability.exe"C:\Users\Admin\AppData\Local\Temp\1000003001\Livability.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000004051\trud.exe"C:\Users\Admin\AppData\Local\Temp\1000004051\trud.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 12366⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000005051\linda5.exe"C:\Users\Admin\AppData\Local\Temp\1000005051\linda5.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" .\xHFA.3~E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\xHFA.3~E7⤵
- Loads dropped DLL
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\xHFA.3~E8⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\xHFA.3~E9⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1000006001\z1ugk979.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\z1ugk979.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 5046⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000008001\csgd2.exe"C:\Users\Admin\AppData\Local\Temp\1000008001\csgd2.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1000008001\csgd2.exe" & exit6⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 18166⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000009001\mp3studios_97.exe"C:\Users\Admin\AppData\Local\Temp\1000009001\mp3studios_97.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5d664f50,0x7ffa5d664f60,0x7ffa5d664f707⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1652 /prefetch:27⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1976 /prefetch:87⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 /prefetch:87⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:17⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:17⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:17⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:17⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4224 /prefetch:87⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4676 /prefetch:87⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4960 /prefetch:87⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5124 /prefetch:87⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:87⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4792 /prefetch:87⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5628 /prefetch:87⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:17⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:87⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:87⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5728 /prefetch:87⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:87⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4892 /prefetch:87⤵
-
C:\Users\Admin\AppData\Local\Temp\1000010001\random.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\random.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\1000010001\random.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\random.exe" -h6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000011001\pb1109.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\pb1109.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000016001\Liva100.exe"C:\Users\Admin\AppData\Local\Temp\1000016001\Liva100.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000020001\super9.exe"C:\Users\Admin\AppData\Local\Temp\1000020001\super9.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 11362⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\DDA6.exeC:\Users\Admin\AppData\Local\Temp\DDA6.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E018.exeC:\Users\Admin\AppData\Local\Temp\E018.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 3402⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\E25B.exeC:\Users\Admin\AppData\Local\Temp\E25B.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 3402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4252 -ip 42521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4084 -ip 40841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4904 -ip 49041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3520 -ip 35201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4288 -ip 42881⤵
-
C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exeC:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 3162⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exeC:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exeC:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 6083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4232 -ip 42321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5040 -ip 50401⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2096 -ip 20961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1604 -ip 16041⤵
-
C:\Users\Admin\AppData\Local\Temp\94C4.exeC:\Users\Admin\AppData\Local\Temp\94C4.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Oyiesauffusw.tmp",Wuuitfqhpt2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 171333⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 5602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3032 -ip 30321⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exeC:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 3162⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exeC:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exeC:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3420 -ip 34201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
2KB
MD5d725336098482e86274e5930393506a1
SHA17cb24085418693dc0c0fc876b6f7d2d400a7c256
SHA256a2550a47e8dee78c170ecdfc8918137469b6115cf32fedc091b80c7dea2701a1
SHA512f67ff810c97f14f9704439a7a3d34588b013eedc97149298c833926bc92d12b1e76b68c684863f86f8dede7fc677139f6c8af8e83bd43cad965ed32bda15ed3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751Filesize
717B
MD5ec8ff3b1ded0246437b1472c69dd1811
SHA1d813e874c2524e3a7da6c466c67854ad16800326
SHA256e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab
SHA512e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD5bae107243c3c1cc23eb066f981b79948
SHA1ed066a4326ae4eb5db4b00b0bb0290f006ad456c
SHA2567d2ba9f4e363368512dc2388d792c3f971d18699234c4edab57ddd4053870026
SHA51267a0ba993ab7abab0973683f134d71ed96cbff33368b222fc84e57def50c57d1c6d1c64362738baa9efa8cd84a3ccee30cc67284b2cd8ea53cbb8d1bfed94764
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
488B
MD5091500f3eb6629395fcc7b3945943ecd
SHA157761898dd3aeb24105bf1d20b31c8eaa941c557
SHA256ae009001466cfd87f2d1e249a87b9f3b134cf2c027655f1026590b72364614b3
SHA512a55d5af81f29dbd40c038b14621220fd25ba6b1f1de44f62ead9357b61ee04bdce199b6359c4a7e124cc16269d849b14c50566b5be08f4ef9ac0399092f80383
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751Filesize
192B
MD5411164d33c75694fece515a0ede87fb1
SHA1cd84149d88fd6e68e85477613d3037ff97eee7cf
SHA256e7e8f120a48f696c97d4a07cb5a21888a6380986f971bafeadcd0b11253d6eba
SHA512d159e404afa47e3981475b442fa3b63b665b21a2c7eec3e992b4f227b74d66600b0215d5183b22ceedda061d54202eb0522cb3c4a989446e932b7ac902df38ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD5be65ec2b4132e4ebbe97cd928152b5cb
SHA15a83c0ced9fd5e9f9d970435e29622d60fda4be7
SHA256724ba7927628161bd436085ded38eba204378995231ef3730ed56ab931d8b737
SHA51231d38a994d4498be17bdde2f05f113d7a13d2fcd215eeeff8853fc073acf9e473b895247e7bbb14409950aae3476e9fc37c00c3f6726a41c1e4dec05c5524597
-
C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exeFilesize
409KB
MD5a131064868de7468d2e768211431401b
SHA1381ad582f72b30b4764afe0a817569b384be65a2
SHA256027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1
SHA51240fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309
-
C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exeFilesize
409KB
MD5a131064868de7468d2e768211431401b
SHA1381ad582f72b30b4764afe0a817569b384be65a2
SHA256027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1
SHA51240fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309
-
C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exeFilesize
409KB
MD5a131064868de7468d2e768211431401b
SHA1381ad582f72b30b4764afe0a817569b384be65a2
SHA256027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1
SHA51240fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309
-
C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\Temp\1000001001\build.exeFilesize
29KB
MD51496b98fe0530da47982105a87a69bce
SHA100719a1b168c8baa3827a161326b157713f9a07a
SHA256c7c03c2d6a78eb79409a53304bfaf8a69334d2f6a5928db641092bcc39dc8e8d
SHA512286c28a228dda2d589e7e5a75027c27fcc69244b8fec2ae1019d66a8fe6aa00ef245682a1e2dd3f37722c9c4220f2ddc52ab8750369842da028970c59513dcc6
-
C:\Users\Admin\AppData\Local\Temp\1000001001\build.exeFilesize
29KB
MD51496b98fe0530da47982105a87a69bce
SHA100719a1b168c8baa3827a161326b157713f9a07a
SHA256c7c03c2d6a78eb79409a53304bfaf8a69334d2f6a5928db641092bcc39dc8e8d
SHA512286c28a228dda2d589e7e5a75027c27fcc69244b8fec2ae1019d66a8fe6aa00ef245682a1e2dd3f37722c9c4220f2ddc52ab8750369842da028970c59513dcc6
-
C:\Users\Admin\AppData\Local\Temp\1000002001\bin.exeFilesize
225KB
MD56a59c469713da7bb9abc4b8f2e8ac6da
SHA1e87a23b50b3f3a41c50d62e558153d3a3010a02b
SHA2563d21285ae1a22e1954c31393ce1a7238054d9a78b5ec7560235261cb99df918d
SHA51216e7c44c8026016439f2c2eac8ae05a7f0ae6115882897d885837a6f5c37c3b19f5cba53202e691a11e632615d921adb50979077d0e50898cce49d2fbe7bca65
-
C:\Users\Admin\AppData\Local\Temp\1000002001\bin.exeFilesize
225KB
MD56a59c469713da7bb9abc4b8f2e8ac6da
SHA1e87a23b50b3f3a41c50d62e558153d3a3010a02b
SHA2563d21285ae1a22e1954c31393ce1a7238054d9a78b5ec7560235261cb99df918d
SHA51216e7c44c8026016439f2c2eac8ae05a7f0ae6115882897d885837a6f5c37c3b19f5cba53202e691a11e632615d921adb50979077d0e50898cce49d2fbe7bca65
-
C:\Users\Admin\AppData\Local\Temp\1000003001\Livability.exeFilesize
403KB
MD53229c8c943f3a2ba40334e2b1240d0d8
SHA1d214944064dd7d5ebed41f514013f297feff8109
SHA256de7c689d14ca60ffa4258d96b7b8911180aaaa5668bc9785ba27b3cdb44a28a2
SHA512779590ffcd0261fb9521257cbf76b04311d3a4481766636abdc0cf153981ef5cc769df4691b0575ce5b4ad9062feb97899d18ffc8a110946ba5a436f78306df4
-
C:\Users\Admin\AppData\Local\Temp\1000003001\Livability.exeFilesize
403KB
MD53229c8c943f3a2ba40334e2b1240d0d8
SHA1d214944064dd7d5ebed41f514013f297feff8109
SHA256de7c689d14ca60ffa4258d96b7b8911180aaaa5668bc9785ba27b3cdb44a28a2
SHA512779590ffcd0261fb9521257cbf76b04311d3a4481766636abdc0cf153981ef5cc769df4691b0575ce5b4ad9062feb97899d18ffc8a110946ba5a436f78306df4
-
C:\Users\Admin\AppData\Local\Temp\1000004051\trud.exeFilesize
346KB
MD5020902f785bf718ab5e94ea1e96dc730
SHA135dee2365846cbaf6829f8d6dcbf8d2826fc873f
SHA256a31f3ce34cb36681e790afecba9a461afbde1226d70b2bee0758a6a6294aa674
SHA512c8de5da189a88ac88441a349e083343f6f70bbf02214afdcf83840d3e08a5f9ca3b9ae3e78a5a99017a8f2daa3461ab4c187d20969c6de51e9a3a4133071bfc5
-
C:\Users\Admin\AppData\Local\Temp\1000004051\trud.exeFilesize
346KB
MD5020902f785bf718ab5e94ea1e96dc730
SHA135dee2365846cbaf6829f8d6dcbf8d2826fc873f
SHA256a31f3ce34cb36681e790afecba9a461afbde1226d70b2bee0758a6a6294aa674
SHA512c8de5da189a88ac88441a349e083343f6f70bbf02214afdcf83840d3e08a5f9ca3b9ae3e78a5a99017a8f2daa3461ab4c187d20969c6de51e9a3a4133071bfc5
-
C:\Users\Admin\AppData\Local\Temp\1000005051\linda5.exeFilesize
1.5MB
MD554f15563117da20b22b49641a4f97ba1
SHA15bd84b175075e754791ad024fbeb2bed03c3f94c
SHA256deda18b3ad01d443139f40a9d9433a63e68d3dcd0af8eeda13cc8115aeb6b838
SHA512a2e06542a2abc57d19dcb63a64bc588bd1d2624725819adc65a01110bd7986c864a7dae939f12d07f4b6ef15c8df8872ac4dfb7a8b0f85eef4771009b54d9249
-
C:\Users\Admin\AppData\Local\Temp\1000005051\linda5.exeFilesize
1.5MB
MD554f15563117da20b22b49641a4f97ba1
SHA15bd84b175075e754791ad024fbeb2bed03c3f94c
SHA256deda18b3ad01d443139f40a9d9433a63e68d3dcd0af8eeda13cc8115aeb6b838
SHA512a2e06542a2abc57d19dcb63a64bc588bd1d2624725819adc65a01110bd7986c864a7dae939f12d07f4b6ef15c8df8872ac4dfb7a8b0f85eef4771009b54d9249
-
C:\Users\Admin\AppData\Local\Temp\1000006001\z1ugk979.exeFilesize
434KB
MD516f7152d86e037dbb89ec3db76f30fb7
SHA1ba2908a7a1b6706c26a2187b8ba476b9400e50a8
SHA25673b110d9cc838628a97f5e9fabdb49b2df33a90b3b8c61e59e8ae850df88abab
SHA5123e51aaa84dabe5d37ea12f7946405d646882aaf5ac1bc25c4aeda7048d5f5d137285cb441f92e513e8669bda425c62e46fa85b95314b17e2a2f89af4576cb022
-
C:\Users\Admin\AppData\Local\Temp\1000006001\z1ugk979.exeFilesize
434KB
MD516f7152d86e037dbb89ec3db76f30fb7
SHA1ba2908a7a1b6706c26a2187b8ba476b9400e50a8
SHA25673b110d9cc838628a97f5e9fabdb49b2df33a90b3b8c61e59e8ae850df88abab
SHA5123e51aaa84dabe5d37ea12f7946405d646882aaf5ac1bc25c4aeda7048d5f5d137285cb441f92e513e8669bda425c62e46fa85b95314b17e2a2f89af4576cb022
-
C:\Users\Admin\AppData\Local\Temp\1000008001\csgd2.exeFilesize
4.4MB
MD549f7e7a159774bdf056aed4fa46923dd
SHA11dbb57aeed6a7fa2bf516835d5013d6d7429e268
SHA2560fe374cd82f2f922d0ae727ea182b86dc8a9838ad00e5fac6d0d8f673d1d36fd
SHA512faaf85488753eec1ceb663c518b041488f3d970eb7935e9d584c0a52223439967bc782e79de86a2bc70a5b6e1e483c5235ab8a3749bacba32b4b5cb01b7ced39
-
C:\Users\Admin\AppData\Local\Temp\1000008001\csgd2.exeFilesize
4.4MB
MD549f7e7a159774bdf056aed4fa46923dd
SHA11dbb57aeed6a7fa2bf516835d5013d6d7429e268
SHA2560fe374cd82f2f922d0ae727ea182b86dc8a9838ad00e5fac6d0d8f673d1d36fd
SHA512faaf85488753eec1ceb663c518b041488f3d970eb7935e9d584c0a52223439967bc782e79de86a2bc70a5b6e1e483c5235ab8a3749bacba32b4b5cb01b7ced39
-
C:\Users\Admin\AppData\Local\Temp\1000009001\mp3studios_97.exeFilesize
1.4MB
MD5e43f1f1ddaab485bc4add19e6a287961
SHA1aca20dc9c91d15a2d745e8c0eb0f4b88aa9c51e6
SHA256860d80b5d9206f6621dcb8302ad4a06a04d3e4c0ac211ee8077e9e3952680de0
SHA5127c6c907e64054e70341eebb205c41a0cce9797ade7897341f2380af16cfdd979192e39857b0bda220f6d605e496ceae96d01f3d65af460bc4f3c9993d95b9bbb
-
C:\Users\Admin\AppData\Local\Temp\1000009001\mp3studios_97.exeFilesize
1.4MB
MD5e43f1f1ddaab485bc4add19e6a287961
SHA1aca20dc9c91d15a2d745e8c0eb0f4b88aa9c51e6
SHA256860d80b5d9206f6621dcb8302ad4a06a04d3e4c0ac211ee8077e9e3952680de0
SHA5127c6c907e64054e70341eebb205c41a0cce9797ade7897341f2380af16cfdd979192e39857b0bda220f6d605e496ceae96d01f3d65af460bc4f3c9993d95b9bbb
-
C:\Users\Admin\AppData\Local\Temp\1000010001\random.exeFilesize
135KB
MD510e9f08a128e0a4f26427ecdd1293646
SHA161967c24f67ba1b0194d74f9dd7f8d8e95c8df0a
SHA256781f273dcf2fc98a60b600dc16b52f41a25e5d701212c1822ada88a8ce15e9db
SHA512926abad90e879365426ba5203cd188726254392c73f3e23fa14f9656a8745f00994f4077c899dd9280bdc33b4140198bbd867cdc529fd3b2574dee45932a389b
-
C:\Users\Admin\AppData\Local\Temp\1000010001\random.exeFilesize
135KB
MD510e9f08a128e0a4f26427ecdd1293646
SHA161967c24f67ba1b0194d74f9dd7f8d8e95c8df0a
SHA256781f273dcf2fc98a60b600dc16b52f41a25e5d701212c1822ada88a8ce15e9db
SHA512926abad90e879365426ba5203cd188726254392c73f3e23fa14f9656a8745f00994f4077c899dd9280bdc33b4140198bbd867cdc529fd3b2574dee45932a389b
-
C:\Users\Admin\AppData\Local\Temp\1000010001\random.exeFilesize
135KB
MD510e9f08a128e0a4f26427ecdd1293646
SHA161967c24f67ba1b0194d74f9dd7f8d8e95c8df0a
SHA256781f273dcf2fc98a60b600dc16b52f41a25e5d701212c1822ada88a8ce15e9db
SHA512926abad90e879365426ba5203cd188726254392c73f3e23fa14f9656a8745f00994f4077c899dd9280bdc33b4140198bbd867cdc529fd3b2574dee45932a389b
-
C:\Users\Admin\AppData\Local\Temp\1000040001\super9.exeFilesize
45KB
MD54439bff7fec557da1fb9ed754a838be7
SHA11aac2acba06be9d26209fe5b8b236315a0f8f387
SHA2560283da2469f040a2aadcb65856947035f98dca525639670e658f7bdbe9d4f912
SHA512c277587bb27d13ac18edc1eadf2ba1e1638ba027de7303d45857ece5e3104b4eb9f7f1e67043f02c0a9785893827960e40c35a0661a02d28dfd0d7674db4a243
-
C:\Users\Admin\AppData\Local\Temp\1000040001\super9.exeFilesize
45KB
MD54439bff7fec557da1fb9ed754a838be7
SHA11aac2acba06be9d26209fe5b8b236315a0f8f387
SHA2560283da2469f040a2aadcb65856947035f98dca525639670e658f7bdbe9d4f912
SHA512c277587bb27d13ac18edc1eadf2ba1e1638ba027de7303d45857ece5e3104b4eb9f7f1e67043f02c0a9785893827960e40c35a0661a02d28dfd0d7674db4a243
-
C:\Users\Admin\AppData\Local\Temp\1000050001\Legs.exeFilesize
235KB
MD515f57d45fe2a1e8da248cf9b3723d775
SHA1aafb9168ed62dc2ebeeb8428c3a39a6525142f6c
SHA256bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a
SHA512aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174
-
C:\Users\Admin\AppData\Local\Temp\1000050001\Legs.exeFilesize
235KB
MD515f57d45fe2a1e8da248cf9b3723d775
SHA1aafb9168ed62dc2ebeeb8428c3a39a6525142f6c
SHA256bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a
SHA512aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174
-
C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exeFilesize
281KB
MD502a0070645d2af08116cdba2361f8b18
SHA17e763de143b5fe11f2d241828f9e813098d62fb8
SHA256c58821dd98726193166e6eb0f0d188497c43229ce38cb0de0e71ba5a51ae81fe
SHA51288c019551fa4182899c6f90b739e2cee78e8a8f92342af889fb053746221171ef62c14b532e3a595c1c7842bdd5e0a3ff28246ee0f8cd0ec5139ce5c58829d3c
-
C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exeFilesize
281KB
MD502a0070645d2af08116cdba2361f8b18
SHA17e763de143b5fe11f2d241828f9e813098d62fb8
SHA256c58821dd98726193166e6eb0f0d188497c43229ce38cb0de0e71ba5a51ae81fe
SHA51288c019551fa4182899c6f90b739e2cee78e8a8f92342af889fb053746221171ef62c14b532e3a595c1c7842bdd5e0a3ff28246ee0f8cd0ec5139ce5c58829d3c
-
C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exeFilesize
281KB
MD502a0070645d2af08116cdba2361f8b18
SHA17e763de143b5fe11f2d241828f9e813098d62fb8
SHA256c58821dd98726193166e6eb0f0d188497c43229ce38cb0de0e71ba5a51ae81fe
SHA51288c019551fa4182899c6f90b739e2cee78e8a8f92342af889fb053746221171ef62c14b532e3a595c1c7842bdd5e0a3ff28246ee0f8cd0ec5139ce5c58829d3c
-
C:\Users\Admin\AppData\Local\Temp\D6CD.exeFilesize
399KB
MD5b0ece045401c25a90ae1ba804bb43398
SHA1455c85e07d9b6dbd53fce17bc16a2275d49ac855
SHA25626924a35a830aa53611550b2be4e98b445fd091f5da187350cd7fcb532c265fa
SHA5123e9d24cf4916b5aec9bfadc860cc40ab7afcb0029f53af0449a37cf39b90f5de2973cc76ef65449a74357db5c4a8a39e3fd4c83f6caeb8c8cde10c4e33513fdb
-
C:\Users\Admin\AppData\Local\Temp\D6CD.exeFilesize
399KB
MD5b0ece045401c25a90ae1ba804bb43398
SHA1455c85e07d9b6dbd53fce17bc16a2275d49ac855
SHA25626924a35a830aa53611550b2be4e98b445fd091f5da187350cd7fcb532c265fa
SHA5123e9d24cf4916b5aec9bfadc860cc40ab7afcb0029f53af0449a37cf39b90f5de2973cc76ef65449a74357db5c4a8a39e3fd4c83f6caeb8c8cde10c4e33513fdb
-
C:\Users\Admin\AppData\Local\Temp\D806.exeFilesize
747KB
MD54c025d31ed338ed31c7083a4d35b2bab
SHA1d0173a789dc4c10d9645bbee965d416c065ab08a
SHA256c3828dffd8c8be197ef58cd00d30039bd54b4e364d08815c8f6317265cf6ea4a
SHA512d769a5d9e0f035610d7d166d4726e1d278bf5879e18bdfc3386190d2b9a45674319dca7a4103ec6e54c2bb51aa09ef1b7c1d6293e33613c3970e1caca570a4ea
-
C:\Users\Admin\AppData\Local\Temp\D806.exeFilesize
747KB
MD54c025d31ed338ed31c7083a4d35b2bab
SHA1d0173a789dc4c10d9645bbee965d416c065ab08a
SHA256c3828dffd8c8be197ef58cd00d30039bd54b4e364d08815c8f6317265cf6ea4a
SHA512d769a5d9e0f035610d7d166d4726e1d278bf5879e18bdfc3386190d2b9a45674319dca7a4103ec6e54c2bb51aa09ef1b7c1d6293e33613c3970e1caca570a4ea
-
C:\Users\Admin\AppData\Local\Temp\D806.exeFilesize
747KB
MD54c025d31ed338ed31c7083a4d35b2bab
SHA1d0173a789dc4c10d9645bbee965d416c065ab08a
SHA256c3828dffd8c8be197ef58cd00d30039bd54b4e364d08815c8f6317265cf6ea4a
SHA512d769a5d9e0f035610d7d166d4726e1d278bf5879e18bdfc3386190d2b9a45674319dca7a4103ec6e54c2bb51aa09ef1b7c1d6293e33613c3970e1caca570a4ea
-
C:\Users\Admin\AppData\Local\Temp\D806.exeFilesize
747KB
MD54c025d31ed338ed31c7083a4d35b2bab
SHA1d0173a789dc4c10d9645bbee965d416c065ab08a
SHA256c3828dffd8c8be197ef58cd00d30039bd54b4e364d08815c8f6317265cf6ea4a
SHA512d769a5d9e0f035610d7d166d4726e1d278bf5879e18bdfc3386190d2b9a45674319dca7a4103ec6e54c2bb51aa09ef1b7c1d6293e33613c3970e1caca570a4ea
-
C:\Users\Admin\AppData\Local\Temp\D806.exeFilesize
747KB
MD54c025d31ed338ed31c7083a4d35b2bab
SHA1d0173a789dc4c10d9645bbee965d416c065ab08a
SHA256c3828dffd8c8be197ef58cd00d30039bd54b4e364d08815c8f6317265cf6ea4a
SHA512d769a5d9e0f035610d7d166d4726e1d278bf5879e18bdfc3386190d2b9a45674319dca7a4103ec6e54c2bb51aa09ef1b7c1d6293e33613c3970e1caca570a4ea
-
C:\Users\Admin\AppData\Local\Temp\DA78.exeFilesize
281KB
MD502a0070645d2af08116cdba2361f8b18
SHA17e763de143b5fe11f2d241828f9e813098d62fb8
SHA256c58821dd98726193166e6eb0f0d188497c43229ce38cb0de0e71ba5a51ae81fe
SHA51288c019551fa4182899c6f90b739e2cee78e8a8f92342af889fb053746221171ef62c14b532e3a595c1c7842bdd5e0a3ff28246ee0f8cd0ec5139ce5c58829d3c
-
C:\Users\Admin\AppData\Local\Temp\DA78.exeFilesize
281KB
MD502a0070645d2af08116cdba2361f8b18
SHA17e763de143b5fe11f2d241828f9e813098d62fb8
SHA256c58821dd98726193166e6eb0f0d188497c43229ce38cb0de0e71ba5a51ae81fe
SHA51288c019551fa4182899c6f90b739e2cee78e8a8f92342af889fb053746221171ef62c14b532e3a595c1c7842bdd5e0a3ff28246ee0f8cd0ec5139ce5c58829d3c
-
C:\Users\Admin\AppData\Local\Temp\DDA6.exeFilesize
226KB
MD571ee1e0898006c39e633574d61cc817c
SHA18ed8feec771c823cf3c0caca842a019b8aa2912a
SHA25677467614ff0ccab1245707fb61c452840fb269c30e1513f38ea316c2e97fcea4
SHA512d7637bce73844fe1ecf891a6d1c0f3d9a534621b1565b63c32b94c5759d0a4e0ddc918c6e45efcdc80b9cb91397f44afbb5bf7134b351dd26799b4330119435f
-
C:\Users\Admin\AppData\Local\Temp\DDA6.exeFilesize
226KB
MD571ee1e0898006c39e633574d61cc817c
SHA18ed8feec771c823cf3c0caca842a019b8aa2912a
SHA25677467614ff0ccab1245707fb61c452840fb269c30e1513f38ea316c2e97fcea4
SHA512d7637bce73844fe1ecf891a6d1c0f3d9a534621b1565b63c32b94c5759d0a4e0ddc918c6e45efcdc80b9cb91397f44afbb5bf7134b351dd26799b4330119435f
-
C:\Users\Admin\AppData\Local\Temp\E018.exeFilesize
280KB
MD54aeec3636d36e14a4d15d8914979eedd
SHA1991129eb11c0a58a83eb5714f63d686ea0d76464
SHA2560b8330da973e5f9cb260b78e1a745253574bc74b0b3df926fc917e129fb418d2
SHA5121f0b829b9c8d08efb5561492afc4c714aa14b0f9adf719d16c67e2163bde384ef782972e558d1d4d5218329d29f0b4e0c845ab62b7c17b3d5863a9f94472a96d
-
C:\Users\Admin\AppData\Local\Temp\E018.exeFilesize
280KB
MD54aeec3636d36e14a4d15d8914979eedd
SHA1991129eb11c0a58a83eb5714f63d686ea0d76464
SHA2560b8330da973e5f9cb260b78e1a745253574bc74b0b3df926fc917e129fb418d2
SHA5121f0b829b9c8d08efb5561492afc4c714aa14b0f9adf719d16c67e2163bde384ef782972e558d1d4d5218329d29f0b4e0c845ab62b7c17b3d5863a9f94472a96d
-
C:\Users\Admin\AppData\Local\Temp\E25B.exeFilesize
226KB
MD54c0b5897de5dce06560135240ea223f7
SHA17a4f68edd1d5630db41b5ffef1f41dfd8261324e
SHA25699856460a04e9b2615d0ffa7a1cb94a3f406eed95caab70fb2f496be0d7bdc9b
SHA512d8ccb7f5ba2833835525353ded8c88b90e986e6024fa0c75b0ad54c7b9d57a4ab668174f5cf9625003d4010bc390d5409d9358a744777136130aa81acc09a4a2
-
C:\Users\Admin\AppData\Local\Temp\E25B.exeFilesize
226KB
MD54c0b5897de5dce06560135240ea223f7
SHA17a4f68edd1d5630db41b5ffef1f41dfd8261324e
SHA25699856460a04e9b2615d0ffa7a1cb94a3f406eed95caab70fb2f496be0d7bdc9b
SHA512d8ccb7f5ba2833835525353ded8c88b90e986e6024fa0c75b0ad54c7b9d57a4ab668174f5cf9625003d4010bc390d5409d9358a744777136130aa81acc09a4a2
-
C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exeFilesize
225KB
MD56a59c469713da7bb9abc4b8f2e8ac6da
SHA1e87a23b50b3f3a41c50d62e558153d3a3010a02b
SHA2563d21285ae1a22e1954c31393ce1a7238054d9a78b5ec7560235261cb99df918d
SHA51216e7c44c8026016439f2c2eac8ae05a7f0ae6115882897d885837a6f5c37c3b19f5cba53202e691a11e632615d921adb50979077d0e50898cce49d2fbe7bca65
-
C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exeFilesize
225KB
MD56a59c469713da7bb9abc4b8f2e8ac6da
SHA1e87a23b50b3f3a41c50d62e558153d3a3010a02b
SHA2563d21285ae1a22e1954c31393ce1a7238054d9a78b5ec7560235261cb99df918d
SHA51216e7c44c8026016439f2c2eac8ae05a7f0ae6115882897d885837a6f5c37c3b19f5cba53202e691a11e632615d921adb50979077d0e50898cce49d2fbe7bca65
-
C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exeFilesize
235KB
MD515f57d45fe2a1e8da248cf9b3723d775
SHA1aafb9168ed62dc2ebeeb8428c3a39a6525142f6c
SHA256bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a
SHA512aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174
-
C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exeFilesize
235KB
MD515f57d45fe2a1e8da248cf9b3723d775
SHA1aafb9168ed62dc2ebeeb8428c3a39a6525142f6c
SHA256bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a
SHA512aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174
-
C:\Users\Admin\AppData\Local\Temp\xHFA.3~EFilesize
1.6MB
MD5f8f296db527fa0a84ec79f2ab7f2ece2
SHA1995ae608998b3e869c10bbf33c15bc82941ebd40
SHA2567b733810ccc0251d000179e396e2b030d9e71fcb38ce125fb5521effb4f745af
SHA512c35287546f8c89afc74d760730c31c5e66287973c34a4b866a92a3a0af71857be65314997e02ed4ea6d965d48ce3cd4d7b0dd308e4e35dc4cedbc99e406d4c28
-
C:\Users\Admin\AppData\Local\Temp\xHFA.3~eFilesize
1.6MB
MD5f8f296db527fa0a84ec79f2ab7f2ece2
SHA1995ae608998b3e869c10bbf33c15bc82941ebd40
SHA2567b733810ccc0251d000179e396e2b030d9e71fcb38ce125fb5521effb4f745af
SHA512c35287546f8c89afc74d760730c31c5e66287973c34a4b866a92a3a0af71857be65314997e02ed4ea6d965d48ce3cd4d7b0dd308e4e35dc4cedbc99e406d4c28
-
C:\Users\Admin\AppData\Local\Temp\xHFA.3~eFilesize
1.6MB
MD5f8f296db527fa0a84ec79f2ab7f2ece2
SHA1995ae608998b3e869c10bbf33c15bc82941ebd40
SHA2567b733810ccc0251d000179e396e2b030d9e71fcb38ce125fb5521effb4f745af
SHA512c35287546f8c89afc74d760730c31c5e66287973c34a4b866a92a3a0af71857be65314997e02ed4ea6d965d48ce3cd4d7b0dd308e4e35dc4cedbc99e406d4c28
-
C:\Users\Admin\AppData\Local\e7292bf6-0390-4308-a547-2325f5d851ca\D806.exeFilesize
747KB
MD54c025d31ed338ed31c7083a4d35b2bab
SHA1d0173a789dc4c10d9645bbee965d416c065ab08a
SHA256c3828dffd8c8be197ef58cd00d30039bd54b4e364d08815c8f6317265cf6ea4a
SHA512d769a5d9e0f035610d7d166d4726e1d278bf5879e18bdfc3386190d2b9a45674319dca7a4103ec6e54c2bb51aa09ef1b7c1d6293e33613c3970e1caca570a4ea
-
C:\Users\Admin\AppData\Roaming\1000034050\system32.exeFilesize
879KB
MD545f6980ec4c0108bb1103cbc1906fa18
SHA126504d9884c97a2fab9aa128148a5b36becf9e92
SHA2568bc19641f9095f8c86c3836cf1f9d7b1dd14a1c62da0320ce09d5e27d0104927
SHA51264fc21f11fc4bfbd485111695ee2ac9e1e70f4107893e259aa4d705a7ad647e7968f3c223d8d647124c8b0d8f041bae074c600a0ae168b0eb166cd62ee877049
-
C:\Users\Admin\AppData\Roaming\1000034050\system32.exeFilesize
879KB
MD545f6980ec4c0108bb1103cbc1906fa18
SHA126504d9884c97a2fab9aa128148a5b36becf9e92
SHA2568bc19641f9095f8c86c3836cf1f9d7b1dd14a1c62da0320ce09d5e27d0104927
SHA51264fc21f11fc4bfbd485111695ee2ac9e1e70f4107893e259aa4d705a7ad647e7968f3c223d8d647124c8b0d8f041bae074c600a0ae168b0eb166cd62ee877049
-
C:\Users\Admin\AppData\Roaming\1000038050\bd.exeFilesize
1.4MB
MD5afd26f223230ad20eb208dbaa0164e43
SHA19c92cde80d982dec72e5a2fb6553bc1cd89e8319
SHA256fc0cb0682ccc37bdd72fab5106d45ebf7fb014b15004d65d627f6e2aed0750b4
SHA512e0e284ffdd4ef7421a0c0ffb1cf6e2aa82707a861be84e98713a3efd385f1347d8c869709d941d19c0fb3df0d7e40aec1803fb14cc379cec98eeaf8e196aefce
-
C:\Users\Admin\AppData\Roaming\1000038050\bd.exeFilesize
1.4MB
MD5afd26f223230ad20eb208dbaa0164e43
SHA19c92cde80d982dec72e5a2fb6553bc1cd89e8319
SHA256fc0cb0682ccc37bdd72fab5106d45ebf7fb014b15004d65d627f6e2aed0750b4
SHA512e0e284ffdd4ef7421a0c0ffb1cf6e2aa82707a861be84e98713a3efd385f1347d8c869709d941d19c0fb3df0d7e40aec1803fb14cc379cec98eeaf8e196aefce
-
memory/404-260-0x0000000000000000-mapping.dmp
-
memory/432-201-0x0000000000000000-mapping.dmp
-
memory/452-151-0x0000000000440000-0x00000000004AA000-memory.dmpFilesize
424KB
-
memory/452-136-0x0000000000000000-mapping.dmp
-
memory/688-236-0x0000000007EF0000-0x000000000841C000-memory.dmpFilesize
5.2MB
-
memory/688-193-0x0000000006D20000-0x00000000072C4000-memory.dmpFilesize
5.6MB
-
memory/688-156-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/688-159-0x00000000056F0000-0x000000000572C000-memory.dmpFilesize
240KB
-
memory/688-157-0x0000000005690000-0x00000000056A2000-memory.dmpFilesize
72KB
-
memory/688-235-0x0000000006AC0000-0x0000000006C82000-memory.dmpFilesize
1.8MB
-
memory/688-155-0x0000000005C60000-0x0000000006278000-memory.dmpFilesize
6.1MB
-
memory/688-143-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/688-142-0x0000000000000000-mapping.dmp
-
memory/688-192-0x0000000005A30000-0x0000000005AC2000-memory.dmpFilesize
584KB
-
memory/688-194-0x0000000005BD0000-0x0000000005C36000-memory.dmpFilesize
408KB
-
memory/1116-299-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/1116-317-0x00000000069E0000-0x0000000006A56000-memory.dmpFilesize
472KB
-
memory/1116-298-0x0000000000000000-mapping.dmp
-
memory/1116-321-0x00000000069B0000-0x00000000069CE000-memory.dmpFilesize
120KB
-
memory/1188-231-0x0000000000000000-mapping.dmp
-
memory/1208-269-0x0000000000000000-mapping.dmp
-
memory/1456-328-0x0000000000000000-mapping.dmp
-
memory/1500-234-0x0000000000000000-mapping.dmp
-
memory/1696-330-0x0000000000000000-mapping.dmp
-
memory/1784-265-0x0000000000718000-0x0000000000746000-memory.dmpFilesize
184KB
-
memory/1784-267-0x00000000005B0000-0x0000000000603000-memory.dmpFilesize
332KB
-
memory/1784-253-0x0000000000000000-mapping.dmp
-
memory/1784-335-0x00000000005B0000-0x0000000000603000-memory.dmpFilesize
332KB
-
memory/1964-174-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1964-190-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1964-166-0x0000000000000000-mapping.dmp
-
memory/1964-168-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1964-171-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1964-172-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2096-316-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/2096-315-0x0000000002000000-0x0000000002053000-memory.dmpFilesize
332KB
-
memory/2096-306-0x0000000000000000-mapping.dmp
-
memory/2096-314-0x000000000077E000-0x00000000007AC000-memory.dmpFilesize
184KB
-
memory/2176-277-0x000000006C500000-0x000000006C6A5000-memory.dmpFilesize
1.6MB
-
memory/2176-266-0x0000000000000000-mapping.dmp
-
memory/2176-324-0x00000000039D0000-0x0000000003AAC000-memory.dmpFilesize
880KB
-
memory/2176-332-0x0000000001550000-0x0000000001618000-memory.dmpFilesize
800KB
-
memory/2176-333-0x0000000001550000-0x0000000001618000-memory.dmpFilesize
800KB
-
memory/2176-276-0x0000000003300000-0x0000000003485000-memory.dmpFilesize
1.5MB
-
memory/2184-230-0x0000000000000000-mapping.dmp
-
memory/2240-312-0x0000000000820000-0x0000000000832000-memory.dmpFilesize
72KB
-
memory/2240-309-0x0000000000000000-mapping.dmp
-
memory/2240-313-0x00007FFA61340000-0x00007FFA61E01000-memory.dmpFilesize
10.8MB
-
memory/2328-373-0x0000000000000000-mapping.dmp
-
memory/2344-366-0x0000000140000000-0x0000000140617000-memory.dmpFilesize
6.1MB
-
memory/2344-365-0x0000000000000000-mapping.dmp
-
memory/2356-257-0x0000000000000000-mapping.dmp
-
memory/2360-372-0x0000000000000000-mapping.dmp
-
memory/2408-447-0x0000000000000000-mapping.dmp
-
memory/2728-135-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/2728-134-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/2728-133-0x00000000005A0000-0x00000000005A9000-memory.dmpFilesize
36KB
-
memory/2728-132-0x000000000071B000-0x000000000072B000-memory.dmpFilesize
64KB
-
memory/2884-211-0x0000000000000000-mapping.dmp
-
memory/2884-220-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3032-417-0x0000000000000000-mapping.dmp
-
memory/3124-233-0x0000000000000000-mapping.dmp
-
memory/3164-227-0x0000000000000000-mapping.dmp
-
memory/3232-228-0x0000000000000000-mapping.dmp
-
memory/3264-304-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3264-205-0x0000000000000000-mapping.dmp
-
memory/3264-219-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3264-210-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3264-208-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3336-338-0x0000000000000000-mapping.dmp
-
memory/3344-224-0x0000000000000000-mapping.dmp
-
memory/3488-376-0x0000000000000000-mapping.dmp
-
memory/3520-256-0x0000000000400000-0x0000000000529000-memory.dmpFilesize
1.2MB
-
memory/3520-240-0x0000000000000000-mapping.dmp
-
memory/3520-244-0x0000000000400000-0x0000000000529000-memory.dmpFilesize
1.2MB
-
memory/3520-246-0x0000000076750000-0x0000000076965000-memory.dmpFilesize
2.1MB
-
memory/3520-243-0x0000000077CA0000-0x0000000077E43000-memory.dmpFilesize
1.6MB
-
memory/3640-274-0x0000000000000000-mapping.dmp
-
memory/3744-318-0x0000000000000000-mapping.dmp
-
memory/3944-342-0x0000000000000000-mapping.dmp
-
memory/4028-346-0x0000000000000000-mapping.dmp
-
memory/4048-442-0x00007FF65FF46890-mapping.dmp
-
memory/4084-183-0x0000000000607000-0x0000000000625000-memory.dmpFilesize
120KB
-
memory/4084-184-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4084-158-0x0000000000000000-mapping.dmp
-
memory/4116-152-0x0000000000000000-mapping.dmp
-
memory/4116-179-0x00000000005AB000-0x00000000005BC000-memory.dmpFilesize
68KB
-
memory/4116-181-0x00000000004D0000-0x00000000004D9000-memory.dmpFilesize
36KB
-
memory/4116-182-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/4116-218-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/4184-418-0x0000000000000000-mapping.dmp
-
memory/4220-380-0x0000000000000000-mapping.dmp
-
memory/4232-278-0x000000000067A000-0x00000000006A9000-memory.dmpFilesize
188KB
-
memory/4232-279-0x00000000005F0000-0x000000000063B000-memory.dmpFilesize
300KB
-
memory/4232-245-0x0000000000000000-mapping.dmp
-
memory/4232-280-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/4252-180-0x00000000006E0000-0x000000000071C000-memory.dmpFilesize
240KB
-
memory/4252-169-0x00000000006E0000-0x000000000071C000-memory.dmpFilesize
240KB
-
memory/4252-175-0x00000000007AB000-0x00000000007C9000-memory.dmpFilesize
120KB
-
memory/4252-148-0x0000000000000000-mapping.dmp
-
memory/4252-178-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4288-198-0x0000000000000000-mapping.dmp
-
memory/4288-305-0x0000000000930000-0x000000000099F000-memory.dmpFilesize
444KB
-
memory/4288-295-0x0000000000000000-mapping.dmp
-
memory/4292-229-0x0000000000000000-mapping.dmp
-
memory/4308-204-0x0000000000000000-mapping.dmp
-
memory/4328-261-0x0000000000000000-mapping.dmp
-
memory/4328-262-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4328-268-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4328-336-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/4328-275-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4328-264-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4416-232-0x0000000000000000-mapping.dmp
-
memory/4476-187-0x0000000000000000-mapping.dmp
-
memory/4480-197-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4480-292-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4480-196-0x000000000062A000-0x0000000000648000-memory.dmpFilesize
120KB
-
memory/4480-173-0x0000000000000000-mapping.dmp
-
memory/4480-291-0x000000000062A000-0x0000000000648000-memory.dmpFilesize
120KB
-
memory/4548-371-0x0000000000000000-mapping.dmp
-
memory/4564-293-0x00000000005E0000-0x0000000000A42000-memory.dmpFilesize
4.4MB
-
memory/4564-294-0x0000000077CA0000-0x0000000077E43000-memory.dmpFilesize
1.6MB
-
memory/4564-284-0x00000000005E0000-0x0000000000A42000-memory.dmpFilesize
4.4MB
-
memory/4564-290-0x00000000005E0000-0x0000000000A42000-memory.dmpFilesize
4.4MB
-
memory/4564-195-0x0000000000000000-mapping.dmp
-
memory/4564-281-0x0000000000000000-mapping.dmp
-
memory/4564-287-0x00000000005E1000-0x0000000000622000-memory.dmpFilesize
260KB
-
memory/4564-285-0x00000000005E1000-0x0000000000622000-memory.dmpFilesize
260KB
-
memory/4696-209-0x00000000009A7000-0x0000000000A39000-memory.dmpFilesize
584KB
-
memory/4696-189-0x0000000000000000-mapping.dmp
-
memory/4740-323-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4740-322-0x0000000000798000-0x00000000007C7000-memory.dmpFilesize
188KB
-
memory/4740-251-0x00000000005B0000-0x00000000005FB000-memory.dmpFilesize
300KB
-
memory/4740-252-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4740-250-0x0000000000798000-0x00000000007C7000-memory.dmpFilesize
188KB
-
memory/4740-237-0x0000000000000000-mapping.dmp
-
memory/4904-162-0x0000000000000000-mapping.dmp
-
memory/4904-185-0x0000000000527000-0x0000000000537000-memory.dmpFilesize
64KB
-
memory/4904-186-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/4972-221-0x0000000000000000-mapping.dmp
-
memory/5008-388-0x0000000002E50000-0x0000000002F18000-memory.dmpFilesize
800KB
-
memory/5008-383-0x0000000002D70000-0x0000000002E4C000-memory.dmpFilesize
880KB
-
memory/5008-347-0x0000000000000000-mapping.dmp
-
memory/5040-375-0x0000000000000000-mapping.dmp
-
memory/5100-165-0x00000000006A3000-0x0000000000735000-memory.dmpFilesize
584KB
-
memory/5100-167-0x0000000002230000-0x000000000234B000-memory.dmpFilesize
1.1MB
-
memory/5100-139-0x0000000000000000-mapping.dmp
-
memory/5248-426-0x0000000000000000-mapping.dmp
-
memory/5496-425-0x0000000000000000-mapping.dmp
-
memory/5684-410-0x0000000000000000-mapping.dmp
-
memory/5768-411-0x0000000000000000-mapping.dmp